Security fixes are made on the latest released version. Please upgrade before reporting a problem that only affects an older release.

Use GitHub's private vulnerability reporting. Do not open a public issue for a suspected vulnerability.

Include the affected version, a minimal reproduction, the likely impact, and any suggested remediation. Maintainers will acknowledge a complete report within seven days and coordinate disclosure after a fix is available.

Never include real credentials, tokens, customer data, or other secrets in a report or reproduction.